Social lessons I took from being friends with Dan Kaminsky, in four stories. I hope these will be helpful to you as much as they have been to me.

I miss Dan, we just started talking more thanks to Facebook, and I am devastated by his passing. While sad, remembering these stories, and hearing of his shenanigans from others, has mind-bogglingly made yesterday a happy day, right alongside the sadness. I hope you will find these helpful.

Always make people feel their worth. All it takes is the passion you already feel.

It was defcon 13, 2005, in the Alexis Park. Dan introduced me to some folks.

“This guy,” he said, putting his hand on my shoulder, “I love this guy!” Then he told the world why. “If not for Gadi eCommerce would not have been able to exist, as the Internet wouldn’t be here.”

Obviously, he exaggerated — a lot. But he made me feel appreciated for my work. There was magic in how he spoke to, and of, people.

He then introduced someone else.

“This guy?” He smiled. “I love his work. What he does is nothing less than genius.” Dan then turned to this new person. “I want to work with you. It would be amazing.. Let’s find out how we can do that.”

Gadi of 2005 felt a bit confused, as if Dan does this for everybody, it must not be as real. Today’s Gadi can appreciate it all the more for how Dan found something special, and real, in everyone he met.

Always pull people up. It’s just 15 bucks.

It was defcon 14, 2006, in the Alexis Park.

Dan and I walked lazily by the pool area. We met a young woman (we were young back then, too) who sold t-shirts she made. Dan immediately showed excitement and bought one. I said that the shirt is too small for me, also privately worried over if I could afford to spend the cash. The young woman was upset over my words, disgust came over her face as her lips and nose pulled up, “2X is pretty damn big.”

Dan made her happy with 15 bucks and a good word. I made her upset. Yes, her response was unwarranted, and yes, she fat-shamed me, but that’s beside the point of the story. I learned from Dan that day. I should have bought that t-shirt.

Just ask the question. Many people won’t, or can’t.

23C3, Berlin 2006.

I was speaking about fuzzing, and as usual Dan would come into my talks, and then I’d hand the speaking over to him for the last 5 minutes.

At some point early in the presentation I asked the audience if everybody knows some random technical term, before moving on to the next slide. Dan raised his hand from the back of the room. I was like “seriously? You don’t know what X is?” Then I explained it.

When I asked him about it, he said “many people here may not know it, and won’t raise their hands.” I learned from Dan that day, about speaking, and about raising my hand for others. I also cringe in talks whenever I hear a speaker asking that question.

Objectification isn’t always obvious. I wish guys received training.

2008 in Toronto.

We try to be good people, but sometimes we find we don’t even know we aren’t. I was about to ask the bartender out. I mentioned something about what I want to say to Dan, and he said “don’t be that guy,” sounding sad. I learned that day about objectification in daily language and that it is more subtle than I thought.

Gadi Evron.
(@gadievron on Twitter)

Social Lessons From Dan Kaminsky (In Memoriam) was originally published in The Startup on Medium, where people are continuing the conversation by highlighting and responding to this story.

As some of you know, I’ve been working on virtual conferencing and virtual transformation the last couple of months (shocker), and one of the biggest challenges is transferring the con attendee experience itself, rather than the content. I’d like to open that up for discussion, and learn from others’ experience.

One of the things that bother me about such video conferencing, or as it’s now known, zoom, is that even when leaving out the experiential aspect, when interacting, people revert into a performative state (thanks Ryan Moon for that terminology).

With that in mind, the only fully active and interactive sessions I’ve seen consistently come to be, are “Friendly” unstructured Zoom happy hours. And, sometimes, unpredictably, through chat activity.

My latest thinking is trying “we’ll be talking on X at 2 PM on this Zoom, join us.” And trying to keep the conversation flowing.

This could work for many cases depending on multiple parameters such as number of people present, pre-existing relationships, active vs. lurking, trust, and openness to discourse in general to name a few.

So, naming this to make it clearer: An unconference of limited-size with unstructured panels.

With thanks to Dragos Ruiu who has been giving these things even more thought than I have, and to Daria Medved for schooling me on these topics daily.

Gadi Evron.
(Twitter: @gadievron, Facebook: @gadioncyber)

Virtual Transformation of Experience (in Conventions and Conferences) was originally published in The Startup on Medium, where people are continuing the conversation by highlighting and responding to this story.

I’m a security professional, and I trust Zoom. So should you.

There’s a recent trend among security professionals to ‘gang up’ on Zoom. These professionals should feel ashamed of themselves. For most use cases and users, Zoom is secure and safe.

I will keep this short.

1. Whenever a security issue has been discovered with Zoom, they have been quick to respond and issue a fix. That is far better than can be said of most software companies out there. In cyber security, when bad stuff happens, how you respond is how you are measured. Zoom gets an A+ from me.
2. As an administrator of my Zoom account, I can secure my account. Default settings for those not wanting to mess with the settings were lacking, and guess what? These have been fixed, and are being fixed. It’s now easy for everyone.
3. A lot has been said about Zoom’s encryption not being up to par. I challenge anyone to show me how any other such software of this type handles peer to peer encryption with dozens of folks in the conversation. But you know what? Seeing how Zoom has been inspirationally responsible up to now, I am looking forward to seeing how they innovate on this.
4. Zoom scaled beyond any reasonable growth measure the last few weeks, and still manage to do a good job on security. I’m impressed by that.
5. They do good for the community. That’s an extra off-topic brownie point right there, mentioned second to last.
6. They provide a kick-ass service.

I won’t use Zoom for secrets sharing, but I definitely will use it for everything else. You should too.

Lastly, colleagues, friends, perhaps Zoom isn’t good for your personal use case and they certainly made mistakes. But don’t jump on the bandwagon, it makes you look unprofessional at a time when you of all people must be a lighthouse to your neighbors in a difficult time. That’s what Zoom is doing, and that’s a corporate culture we need to encourage.

Thanks,
Gadi Evron.
(Twitter: @gadievron, Facebook: @gadioncyber)

Edit:
Here is a post by Dave Kennedy, Amit Serper, and Russ Handorf, that goes into the topic more in-depth, from a technical standpoint.

Get off Zoom’s Case. I Trust Them, and so Should You was originally published in The Startup on Medium, where people are continuing the conversation by highlighting and responding to this story.

Do you remember the song Friday by Rebecca Black? Friday Friday ooh? Back seat? Front seat? More than anything, it was one of the best marketing case studies I ever lived through.

It became a huge hit within a week of being released, and everyone absolutely loved to hate it.

Things came to ahead when someone on YouTube released an original Bob Dylan rendition of the song, claiming Rebecca stole the lyrics. The voice was right for his 1960s work. Even the cover art made sense.

Hundreds of people shared their fondest memories associated with the historical version, commenting on YouTube on their first kiss, the song playing in the background.

One shared how he feels the song lyrics capture the cold war and the Vietnam experience. Hundreds and thousands kept on sharing.

“Only a Noble Prizer winner could come up with these lyrics,” said one of the commenters, capturing the spirit of the Internet a few years later.

Thing is, it was a fake, and the Interwebz loved it.

It is one of the best examples of positive trolling, pre-historic Internet memes, and the ridiculousness the net is capable of.

The Internet, reinventing reality since 1920.

Original song (sorry):
https://www.youtube.com/watch?v=kfVsfOSbJY0

Fake Bob Dylan rendition:
https://www.youtube.com/watch?v=9FISHEO3gsM

w/ thanks to Tal Engel who introduced me to this phenomenon back in 2012.

Gadi Evron.
(Twitter: @gadievron, Facebook: @gadioncyber)

Fake News 2011 Style: Bob Dylan’s Reality Shaping Song was originally published in The Startup on Medium, where people are continuing the conversation by highlighting and responding to this story.

It wasn’t when I started writing a flash story out of three writing prompts every day that I knew it. Nor was it when I painfully rewrote my very first short story ever, from scratch, bleeding out of my eyes, that I really knew it to be so.

Even when I spent the entire weekend creating a social media platform out of nothing, so that my successful author’s future self would have it ready, I still didn’t know it to be a sure thing.

When I started studying grammar that’s when it hit me in the face.

I now know I am serious about becoming an author.

You have no idea how many books I read just so that I could absorb English grammar semi-instinctually, and pants my way through writing with somewhat decent grammar.

All that just to avoid sitting down and studying it.
Until today.

If you like, you can follow Gadi Evron (SF&F Writer), where I’ll be posting my work.

Gadi Evron,

— — — — —

Twitter:

@posthocethics for my writing. @gadievron for security and startups.

I want to hold discussions, and feel like I can’t anymore. Here’s how I propose to fix that. At the very least on my own Facebook wall.

First, why do I feel that I can’t?

Some years ago a friend won World’s debate championships. One of his arguments was that you can’t talk about Hitler’s economic policy and not be talking about the Holocaust. Such loaded issues clutter discussion. They leave no room for discussion out of one specific context.

Respecting triggers and sensitivities is reasonable, but having gone to extreme it now limits speech instead of enabling it. Today, nearly any issue would trigger someone on the wide political spectrum, and effectively leaves no place for any context outside of what’s associated with that trigger.

Further, resolution and understanding is not the end goal anymore. Taking offense cerebrally, for what could be offensive to others or to your agenda, as opposed to what you are offended by, is now the norm.

The goal seems to be creating deterrence against those who would go against your sensibilities and sensitivities. I’m unsure if that is good or bad. But, considering all sides of any topic of discussion do this, triggers grow by the minute, and our way of handling triggers is to shut down discussion, discussion itself becomes an unsustainable proposition.

Lastly, people tend to get violent over speech, using their voices to drown out others, effectively using free speech to limit speech. In essence, weaponized speech for advancement of an agenda.

Abandoning the attempt at resolution of disagreement, the attempt at communicating over offense or topics of contention, and the attempt to givepeople the benefit of the doubt, is leading us down a spiral toward the end of the ability to reach empathy. That, leaves only war.

We should be sensitive to others, we should avoid being offensive. Triggers are reasonable to have and to avoid. But there must be a way by which we can hold a discussion outside our own group think limits.

This is not about attacking PC culture which in the US would paint me conservative, or seeking PC culture which in the US would paint me as a progressive. It’s about being about to cordially converse with others.

Hence, now introducing:

Gadi’s House Guidelines for holding a discussion:

1. Assume the other side means well. Be optimistic about intentions.
2. Friends always de-escalate. If you feel like escalating, say why that is. What was it that rubbed you the wrong way? Let’s discuss it.
3. Rules of argument mean less than existence of discussion. A person may have a point, or something bugs them, even if they fail to articulate it at the moment in a way that’s acceptable to you.
4. Collaborate for a good discussion. If collaboration doesn’t exist, disengage.
5. Of you state an opinion without an argument to support it, say so.
6. If you wish to discuss a topic that could be clouded by wider context, admit to the context. Discussion of context is then relegated to another time and only those interested in the out of context discussion should engage.
7. Instead of the weaponizers running you off from the discussion, they are uninvited. Break these guidelines (being mindful of #3 above), and you will be called out on it. You would be the one who is illegitimate, rather than moral outrage, rather than moral outrage instigators. People will disengage, and if disruptive, you may be uninvited from the discussion.

Other guidelines may be added in the future, but these should be good enough for now. I believe in keeping it simple.

I declare any discussion on my Facebook wall to be under the Gadi House Guidelines.

Of course, you are also invited to argue this with me, and discuss the guidelines themselves. I’m happy to make this a collaborative effort.

With many thanks to Stephen Llano and Doron Shikmoni.

Gadi Evron.
(Twitter: @gadievron, Facebook: @gadioncyber)

Conduct of discussion in the age of weaponized speech was originally published in HackerNoon.com on Medium, where people are continuing the conversation by highlighting and responding to this story.

(1) Don’t be vulnerable to the attacker’s lab (they download you, research you, change 2 bits in their attack… and bypass you).

(2) Be 0day agnostic — detect the unknown unknowns. It’s time we stopped accepting tools which detect mostly only the known, as we don’t have high expectations and grew kind of used to mediocrity.

(3) Be effective even if bypassed. Why should an attacker be able to operate with impunity if they manage to bypass your tool?

(4) Detect real attackers, not signs that might indicate an attack. Do it with high fidelity. Don’t be a noise generator!

(5) Share data with other products. Augment them. If you see something, another tool should be able to use it to perform better as well. It’s about the customer’s value, not competition.

And an extra one for vendor behavior, rather than product:

Take the burden to not become shelfware after deployment. If you are not deployed, fully used (as needed), and pushing your customer to deploy — you should be kicked out.

Gadi Evron.
(Twitter: @gadievron, Facebook: @gadioncyber)

#startup #security #cybersecurity #vendor #principles

This story is published in The Startup, Medium’s largest entrepreneurship publication followed by 339,876+ people.

Subscribe to receive our top stories here.

How not to be a crybaby vendor, and start to take responsibility for what we do was originally published in The Startup on Medium, where people are continuing the conversation by highlighting and responding to this story.

Why women?

1. Because we always talk about needing to do something to attract women to our industry, and usually it ends in just talk.
2. Women are hard workers, are just as interested in our field, and usually do not have the industry support network most men do.
3. Because this is what I started doing when I met someone who needed help, and I enjoy it.

Criteria

I’m happy to help anybody with some advice — so message me, but for a full mentorship I found some prior experience helps. Students and professional juniors, who already understand a little bit of system and coding, will get preference.

How many am I willing to mentor?

Two more at this stage.

Warning to applicants

This is an extremely demanding mentorship program. I expect you to become a ninja in a short time — And that requires a lot of hard work.

How can you help?

I’m not quite willing to scale what I do yet (perhaps one day, socially — it’s what I usually do). I am pretty happy with the program I built and with working on it by myself.

But, you can help by sharing this post with those who may be interested.

How can you or someone you know apply?

Message me on Facebook (Gadi Evron on Cyber Security & Privacy), or DM me on Twitter (@gadievron) with your request.

Many thanks to Marion Marschalek, Halvar Flake, Karen Castelletti, Dekel Braunstein, Matt Jonkman, and others who agreed to help with this effort in the past and thus helped nudge me in this direction.

Gadi Evron.
(Twitter: @gadievron, Facebook: @gadioncyber)

Mentoring young women in cyber security was originally published in HackerNoon.com on Medium, where people are continuing the conversation by highlighting and responding to this story.

Music degrees aside, relevant discussions around “what Equifax got wrong” are as predictable as they are ridiculous. There are things that we as an industry can do now which will make a difference, and better patch management just doesn’t cut it. Below I talk on our defeatist industry as I see it, a much needed paradigm shift, and add my own bias in how we can be better in some respects, by using cyber deception.

The critique heard and advice given following each data breach consists of the same old security basics. Don’t get me wrong, as a security professional I believe in basics, and I believe in processes. But, they will never be perfect.

Further, there are endless circles of basics. If an attacker got in through a vulnerability or misconfiguration, should they then be able to own our entire infrastructure? What can we do that is different and will make a difference, and not two years from now, but today?

There is an inherent asymmetry in cyber security, with adversaries who only need to succeed once, while defenders have to remain vigilant all the time, at a huge cost differential. We must think differently. We must shift the economics of attackers, making their operations riskier, and their cost at each step that much higher.

To do this, the basics in security we should be looking at instead are strategic. Do we control our own ground? Are we building static defences or are we agile? Can we control what information the attackers have on us, hence controlling their activities? We are so defeatist in cyber security, each morning going to work we recognize we are going to lose if only the bad guys want it hard enough. I refuse to accept it.

Three years ago, I quit everything and decided to change the conversation. To do this, I opened a company, Cymmetria, focused on creating cyber deception technology to empower the defenders. I was tired of hearing, yet again, about the 250 days until an attacker is discovered, or to see yet another new technology trying to run the rat race of discovering malware or vulnerabilities faster, the same way NetWitness or Trusteer did 10 years ago, only 10% better, with AI on top. To create something new, I looked to the world of strategy. We must shift the asymmetry in cyber security, and more-over, turn the tables on the attackers. This is what cyber deception does.

Back in 2014, I tried to approach people about cyber deception their response was so often, “honeypots?” Today, I am happy to say cyber deception has become a best practice. 2017 has been an amazing year for us with inbound RFPs, projects and budgets, and endless installations. Gartner has helped, defining deception as a top 10 security control for the enterprise.

Cyber deception won’t solve the world’s problems, and won’t catch everything. It does however make attackers’ lives that much harder, while dealing with real pain points. This is how hunting is done. We want to have the same visibility we have at the edge inside of the perimeter? We want to counter lateral movement? Catch responder/Pass-the-Hash? Be able to deterministically say whether an event/alert is real? Cyber deception can do that.

Yet, when a data breach occurs, people still talk about better patch management. While attackers are extremely fast adopters of technology, defenders are not.

Cyber deception isn’t the only new technology out there in security. Further, it won’t solve all of your problems. It will however find attackers in your environment, and help you kick them out. It’s a growing industry. You should look into it, and from my biased perspective, you should look at Cymmetria.

In fact, talk to me. Three years ago I bet my life on the concept. It’s time to take control back and stop being a defeatist industry.

Gadi Evron.
(Twitter: @gadievron, Facebook: @gadioncyber)

#Equifax #databreach #basics #patching #asymmetry #cyberdeception #cymmetria

Equifax cybersecurity aftermath: Stop talking about “basics”, here’s what you can do today. was originally published in HackerNoon.com on Medium, where people are continuing the conversation by highlighting and responding to this story.

If I truly understood key entrepreneurship terminology back when I got started, my life as a founder would have been easier. Trouble is, no matter how much we try, just reading about it doesn’t translate to understanding.

My goal in this post is to explore one of these terms and how my view of it changed, so that when you think you understand it in the future, you may think back to my post and reexamine your conclusions. See what you’ve learned since you last thought about it, and how it affects what you do.

Then repeat at every stage of your company from investor pitching, through customer value proposition and sales, all the way to how you develop your product.

It’s a struggle, and it’s constant. The first trick to winning it is to be aware of it.

TL;DR — Make something people want.

Step 0: Pitching value

Some of your first pitches are to investors. While it is best to derisk as much as you can, when raising a seed you simply are not going to be able to back up every claim.

The beauty of raising a seed if that you are not expected to be able to explain everything, after all, taking a risk on the market is what you are raising a seed for. Your reason for raising the money is to prove a point, whether it is that the technology works, that your team works, or that the market exists.

Thus, you need to choose a value propositions out of many available, based on which is your best researched guess on what would achieve your goals, and/or is the most derisked.

Uber for example could choose any number of value propositions when it just got started, from bridging the inequality gap by providing added income to anyone, to reducing the friction of ordering a taxi.

What’s important is a coherent and convincing, derisked story. Your investors are not dumb — They want to see you’re not either.

Moving on to customers.

Step 1: Technical value: What vs. Why

I remember when I was much younger, I watched an interview with Woz. He mentioned how he used to be able to show people what something does, while today he knows to show them what it does for them.

Value starts from asking yourself what your solution will do for your customer. You may have the best solution in the world, or the most technically advanced one. The question you should be asking yourself is:

What problem does my technology solve for my customer?

And continue by examining precisely who that customer is, and what they currently use to solve that problem,

Step 2: Technical value vs. business value

While your solution may solve the world’s problems, and may have unbelievable technical value, is it a business requirement?

It doesn’t necessarily follow that just because something is a technical need it is also a business need.

What is the business currently using? Is this a big enough problem for them? Has anyone defined solving this problem as a requirement? Does it have a budget allocated? Has a project been created to handle this issue?

If not, are you saving them money or other resources such as time? How difficult would it be for them to implement? Would they have to spend effort on it over time?

At my startup, Cymmetria, one of the security (technical) value points, or deliverable — The what, would be:

“Deploying data across endpoints which will redirect attackers’ efforts to environments we control, detecting them faster along with the associated forensic information.”

While faster detection is valuable, it may not be enough. A lot of solutions would try to claim being faster at something. Another pitfall is showing value, but not one that directly affects your customer:

“Punching attackers by shifting the economics on them. Increasing their costs exponentially, catching them and collecting the associated forensic information much faster.”

Instead, an example business value proposition, or benefit — The why, would be:

“Cyber deception counters attackers once they already gained access to your environment. It provides with visibility into your perimeter, with a control for catching attackers once they attempt lateral movement.”

Step 3: Qualifying your customer

Only when you explain the business value would you be able to start exploring your market. You’ll also be able to gather feedback on how palatable the idea is to your potential customers. Being right too soon is a major sin of entrepreneurship.

Qualifying a customer isn’t just for the sales process. It’s critical when exploring your idea and doing market research.

You may start hearing objections such as “this is very interesting, but we have a lot on our plate right now.” Or “we like this a lot, but we don’t currently have the resources to do so due to other projects.” Or maybe “we would be happy to take a look at this next year.”

Remember, even if your contacts see the value, their boss might not, and their bonuses are tied to them meeting KPIs their management set.

The entire first year of our startup revolved around objections such as this.

Step 4: Shifting with your customer vs. educating the market

Constantly reexamine your messaging. Pivoting does not have to be changing what your company does, it can be as simple as adjusting your value proposition to fit what you do to what your customer needs. Product market fit is undeniable when it exists. Your growth is like fire burning through a dry field. However, product market fit is rarely immediate.

That said, the pain of educating the market can last years, and outlast your funding.

That is not to say you should give up on your idea, choose entrepreneurship with no innovation, or choose to avoid ideas where market education is required. In fact, some of my best friends build startups only around ideas so innovative, educating the market and the pain associated with it is the course they must take.

Don’t be afraid to innovate, it’s what you’re here for. Remember what Ford said on what customers would have asked for if he asked them? They would have wanted faster horses.

More on product market fit in a future post, though.

MVP as a way of life

Value is not just about messaging. Your entire startup must be a part of the value seeking process. I am happy to explore new technologies, but I always ask myself: Why? What is the customer value?

Then, I proceed to qualify it, and choose whether I want to take a risk on it or not. Remember, entrepreneurship is about risk taking, but only you can determine your risk appetite.

Most importantly though, I test the waters. Developing anything more than the most basic bare-bones MVP, for any feature, makes little sense (in most cases) without customer traction.

Therefore, as the classic generic advice goes: Go to your customer! Build a bare-bones system in a few weeks — if you spend more time on it you’re likely doing it wrong — And change your goal to a new battle — finding a place to test

Gadi Evron.
(Twitter: @gadievron, Facebook: @gadioncyber)

#startups #valueproposition #productmarketfit #pitching #messaging #MVP

Critical startup basics I couldn’t really understand by reading #1: Value was originally published in The Startup on Medium, where people are continuing the conversation by highlighting and responding to this story.